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Foreword 


Stephen Bonner — Executive Director Regulatory Futures and 
Innovation 


Transparency is about more than just explaining what data gets gathered, how 

it’s used, where it goes. Bad privacy information design obscures risks, unravels 
good user experiences, and sows mistrust between children, parents and online 
services. 


Great transparency design empowers children to realise the benefits of their 
personal data, builds digital literacy and resilience. It lays the foundations for 
children and parents to navigate the online world together with understanding, 
and without conflict. The Children’s code transparency standard compels 
organisations to realise this positive vision, and ensures they ultimately design 
services that have the best interests of children at their heart. 


We recognise that online services are still on a journey to conforming with this 
standard. Our transparency champions open call supported them through this 
process. This report celebrates current good practice observed through the call, 
and showcases the ‘art of the possible’ when it comes to designing data 
transparency for children. 


I thank the 21 organisations who participated in the call for their openness with 
their work, and for the excellent standard of submissions received. We see this 
as the beginning of an ongoing conversation around how to better design data 
transparency for children. These submissions demonstrate that great design can 
be innovative and yet conform to data protection requirements. Engaging the 
audience isn’t optional to ensure real transparency. 


I hope you enjoy these highlights, and that they provoke you to design better 
online services for children. 
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The transparency champions open call 


In February 2021, the Information Commissioner’s Office (ICO) launched the 
Children’s code transparency champions open call.! The call invited participants 
to share their vision for how online services can meet the code’s transparency 
standard,? and empower children to understand and meaningfully engage with 
how their data is used. 


The transparency standard sets out principles for the effective design of policies 
and community standards, privacy information and choices for children. This 
ensures they are concise, prominent and accessible to children of all ages. It 
articulates how online services that are likely to be accessed by children should 
comply with the principles of fairness and transparency. These are two 
fundamental cornerstones of data protection law in UK GDPR Article 5 (1). 


The open call was motivated by a desire to share current good practice and 
emerging innovations in this space. It recognises the fact that there is still 
progress to be made as we approach the end of the code transition period in 
September 2021. We hear from stakeholders that privacy information can be 
hard to find and understand, and is too often treated as a tick-box compliance 
exercise. A 2018 academic review of the 1,200 highest ranked apps targeted at 
children from the Google and Apple app-stores found the average reading age 
for privacy policies was 13 years-old’. This is understandable given the 
complexity of the average services’ data use, but still four years above the Office 
for National Statistics’ estimated average UK adult reading age of nine.‘ 


21 participants responded to the call, representing a range of apps, websites, 
games, children’s rights advocates, academics, and students. We thank them for 
their willingness to be open with their work and the excellent quality of 
submissions that will offer invaluable inspiration for other organisations in-scope 
of the code and beyond. 


This report outlines the findings of a review of open call submissions by the ICO 
Children’s code team, members of the ICO Children, parents and schools 
Advisory Panel (CAP), and design agency Big Motive.° Their collective expertise 
spans data protection law and the code, children’s rights and development 
needs, and digital service design. Reviewers were asked to reflect on how 
submissions meet the good practice principles outlined in the code’s 
transparency standard, including accessibility, prominence, and tailoring 
information to the age of a child. The open call text, including more details on 


1 Children’s Code: Transparency champions open call | ICO 

2 4. Transparency | ICO 

3 JMIR mHealth and uHealth - Privacy Policies for Apps Targeted Toward Youth: 
Descriptive Analysis of Readability 

4 Reading level - Style.ONS 

*The ICO are partnering with Big Motive to develop Children’s Code support and 
guidance for the design community: Home e Big Motive 
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these principles, is provided in annex A. The following sections highlight thematic 
areas of good practice identified for others to draw inspiration from, and discuss 
opportunities for further progress of designing transparently for children. 


Six recommendations for designing transparency 
for children 


We have six overarching recommendations for organisations looking to design 
effective privacy choices and information for children. These are drawn from the 
good practice themes and opportunities for future progress outlined in the 
following sections: 


Be creative with format - but avoid style over substance. 
Iconography, video, cartoons, audio and characters can all be 
really effective in engaging children with privacy information and 
choices. The medium used should ultimately depend on what your 
child users can relate to and makes sense it the context of your 
service’s user experience, not just what looks best. 


Put children’s needs and views at the heart of the design 
process. Engage with your child users at all stages of the design 
cycle to ensure your service meets their needs and best interests. 
If this isn’t feasible, look for existing evidence on children’s needs. 
Use child-appropriate design approaches, building on available 
open-source design tools, if needed (some of which are mentioned 
in this report). Use insights gathered to help evidence to the ICO 
that your services meet the code transparency standard. 


Meet children and parents where they are. Be realistic about 
the average child’s, and parent’s, levels of data literacy. Provide 
resources to help them where they don’t understand privacy 
information. 


Unbundle privacy information for engagement and 
understanding. Avoid temptations to condense all privacy 
information into one place. Think about engaging with children in a 
more targeted way, at the points where the information is most 
relevant and needed. 


O0 0O ©) © 


Create space for meaningful parent-child conversations. 
Design moments, and supporting resources, for guardians and 
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children to discuss privacy information and choices together - not 
just fleeting tick-boxes for gaining parental consent. 


Prominence is key. Don’t just focus on making the transparency 
design effective, ensure children will interact with it too. Look for 
ways to embed privacy moments in children’s common user 
journeys and service interactions. Gamification and nudging help 
lead users towards privacy information. 


Good practice themes 


Accessible mediums 


Online the status quo for terms and conditions and privacy policies is written 
text. But for many children, whose literacy and cognitive skills are still 
developing, this creates considerable challenges around accessibility and 
engagement. The code encourages online services to address these challenges 
by thinking carefully and creatively about the mediums they use to convey 
privacy information. They should explore the use of iconography, audio, video 
and other forms. 


Open call submissions spanned this diverse range of mediums, and included 
comic strips, videos, games, and an array of privacy characters intended for 
children to engage with. 


Several organisations developed child-like characters that were grounded in their 
pre-existing design language and service features, including Lego’s Captain 
Safety, and Google’s “Be Internet Legends”. The rationale behind the use of 
such characters was articulated by Google’s submission, who outlined their 
design principle for younger children to “bring a childlike character with who they 
can relate to into the mix”. 


6 https://www.lego.com/en-gb/kids/legal/cookie-polic 
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Figure 1: A still from Lego’s “Captain Safety” safety policy video. 


Cracknell Law’s visual legals team submitted a dynamic illustrated concept, 
where their character’s actions reflect the app’s changing use of the child’s own 
geolocation data in real-time. The benefits of such an approach were articulated 
by one Children’s Advisory Panel member, who observed that “a cartoon can 
capture a scenario that people are familiar with and use that as a platform for 
relating the scenario to privacy”. The Children’s code team thought that 
embedding privacy information as part of the design results in a more consistent 
user experience. Children might engage more with privacy information that does 
not feel separate to the design of the service or take them away from their core 
activity. 
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Figure 2: Cracknell Law’s geolocation app cartoon depicts how child users geolocation data is 
being used in real-time. 


Open design methods and child participation 


Some participants used the open call to share innovative design approaches for 
children, with a view to supporting others to ensure their service designs are 
effective and meets children’s needs in the real-world. Others, in setting out 
their rationale for their concepts, highlighted important insights and sources of 
evidence for understanding children’s changing capacities. 


TTC labs submitted their ‘How to design with trust, transparency and control for 
young people’ design guide.’ This encompassed design principles for children, 
guidance on running co-creation “design jams” with children, and a series of 
child user personas corresponding to each age from nine to 18. The review panel 
commended the guidance’s focus on involving young people directly in design 
conversations, and saw the guidance as an accessible gateway into design 
thinking for organisations unfamiliar with such approaches. Google’s “snowball 


7 TTC Labs - How to design with trust, transparency and control for young people 
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fight” 8 and “co-create illustrations methods”? were praised for introducing play 
into design approaches, and exploring ways for non-verbal communication that 
are particularly accessible for younger children. 


Elsewhere submissions highlighted external bodies and resources that can 
support transparency concept design. Revolut described how their Revolut Junior 
privacy policy’? text was iterated through beta testing with a panel of child users 
and engagement with the Plain English Council. For Schilling’s “jargon-free social 
media Ts & Cs” submission, the law firm partnered with education platform Tes 
and a qualified primary school teacher to develop the concepts. 


The Behavioural Insights Team’s use of online experiments and trial data for 
design testing was commended for focus on understanding real-world 
behavioural interactions with designs, and questioning assumptions about how 
people behave online. SuperAwesome also used the PopJam platform to consult 
with a community of children in the development of their designs. 


More broadly, the Children’s code team noted the potential for data and 
evidence to be used to demonstrate code conformance, and meet the Data 
Protection Impact Assessment standard’s recommendation to consult directly 
with children and parents. This evidence was generated throughout the design 
process but particularly from the direct feedback or observed service behaviours 
by children. 


8 Google describe this method as “Enacting a snowball fight is a playful research method 
to assess participants’ current knowledge of key terms and understand what words they 
use to describe them.” They describe a four-stage process: “1. Prepare privacy 
concepts/terms you want to learn more about and write them down on small pieces of 
paper. Crumple them up. 2. Get children and parents together in small groups. Let them 
choose a piece of paper. Ask them to use the piece of paper as a snowball and throw it 
at each other. 3. After 30 seconds, ask everyone to open their piece of paper and 
describe what it says without using the written down word.4. Record how easily and 
accurately children were able to describe and guess concepts. Learn from how parents 
are describing concepts to children.” 

° Google describe this method as “Ask participants to draw specific concepts and then 
use the drawings as a conversation starter.” They describe a four-stage process: “1. 
Before the research session, ask children to complete drawings of 1-3 concepts you want 
to talk about as pre-work. Provide examples of fidelity of drawings you're looking for, so 
children are not intimidated. 2. Prepare a grid of adjectives you want to know about for 
your illustration guidelines as a notes sheet, so you can easily check boxes during the 
research session. 3. In 1:1 research sessions, ask children which drawing they want to 
start with and what they want you to know about it, to keep it open-ended.4. Note how 
children talk about their drawings (eg, do they give it a name?) and note what they look 
like (eg, an abstract shape? an animal? what colours are used?) to help inform your 
illustration style.” 


10 Terms & Policies | Revolut 
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Meeting children and parents where they are 


Across submissions, the review panel felt organisations did a good job of 
articulating information in simple child-friendly language. They implied a good 
understanding of what child users can reasonably be expected to understand. 


Parentzone were also commended for including a “I don’t understand” option in 
their Ollee design. This was seen as a simple-but-effective approach: 


e for testing the user experience; 
e understanding general levels of child-user literacy; and 


e opening a pathway for children to request more or less complex 
information (which the code transparency standard recommends). 


One reviewer reflected on how formats children engage with in their everyday 
lives — specifically memes - could be used to promote engagement and 
understanding. “Memes might be more effective - [children] are often already 
invested in them and it changes the power dynamic: They are in on the joke, 
which could lead to greater understanding and behaviour change, [and] it’s 
something people are familiar with”. 


Elsewhere other submissions acknowledged that parents and teachers will often 
need support to understand and engage with privacy choices on behalf of 
children. The review panel noted this was important given adults’ data literacy is 
often no better than older children’s.‘ Google, XRSI, and Schillings all provided 
dedicated resources for this audience. 


Opportunities for progress 


Unbundling privacy information for clarity 


Clarity and simplicity of information is a fundamental cornerstone of 
transparency. For service features such as privacy policies where multiple forms 
of data processing may need to be communicated, clarity is particularly 
important. 


11 Me-and-My-Big-Data-Report-1.pdf (liverpool.ac.uk) / Data literacy: what is it and how 
do we address it at the ODI? - The ODI 
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The review panel noted submissions 
did well to translate content into 
child-friendly language and 
accessible formats. But they also felt 
some attempted to condense too 


099% EZE 


Media mated much information into a single 
design, and advised online services 

to be more realistic about the 
average child user’s level of data 
literacy. On the latter point, 

not sold i Parentzone’s “Ollee” design was 
a a praised for “starting with the 

— fundamentals of saying what data is, 

which is fantastic - too often we 
forget that”. 


DATA SOLD DATA RIGHTS ADS & TRACKING 


Is the data sold? Whatrightsdol Are there advertisements or 


havetothedata? tracking? 


vY Data are not sold or v Users can Y Data is not shared for third- 


v Data are not shared V Processes to Y Behavioral or targeted 


for research and/or download user advertising is not displayed. 


product improvement. data are 
available 


Y Users can opt out Y Processes to Y Data is not used to track and 


Some review panel members saw 
potential for standardised, cross- 
service, iconography and platform 
features to help children distil 
complex privacy information into key 
messages. This includes Common 
Sense Media’s “privacy nutrition 
label”!? and Juventude Privada’s 
“data assistant”!?. Here however 
they noted significant challenges around adoption and scale, with the success of 
these approaches ultimately dependant on the extent to which they are 
commonly recognised by children and parents. 


from the disclosure or delete user data target advertisements on other 


sale of their data toa are available. third-party websites or 


third party. services 


Read the full privacy evaluation. 


Figure 3: An example of a Common Sense 
Media privacy nutrition label 


The feasibility of communicating complex issues through iconography, and the 
importance of testing icons interpretation with users to ensure they don’t 
inadvertently mislead, also needs to be considered. 


Supporting meaningful parent-child engagement 


Parents and guardians play a fundamental role in supporting young people to 
navigate their privacy choices online. Parents must give consent on behalf of 
children under 13, whilst those in older age groups may still require parental 


12 Building a Better Nutrition Label for Privacy | Common Sense Education 

13 Juventude Privada’s description: “Inspired by the animated paperclip assistant 
“Clippy”, released by Microsoft for Office in 1997, I would like to propose the creation of 
an animated data assistant, which would be available to explain to users of applications 
and websites their rights, use of data and other relevant information about data 
protection and privacy. The assistant could be implemented across all sectors that 
engage with children, so that it becomes a reference in the market.” 
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support to understand the implications of their choices — particularly where data 
processing is complex or risky. 


Review panel members outlined the importance of design in mediating these 
parent-child conversations. There should be a balance between the need for 
parental oversight and support with children’s rights to have their views heard 
and develop their digital and data literacy. 


Two submissions were commended for providing supplementary materials for 
parents and teachers to understand and explain privacy information to children. 
But in general the panel felt more could be done to strike this balance, with 
designs tending to focus on gaining parental consent over creating a space for 
genuine dialogue between them and children. 


One reviewer saw potential to increase the friction of privacy choice designs, 
reflecting that “for digital services friction has often been the enemy. But if we 
can reframe friction as [an opportunity for engagement]- encouraging children 
and parents to ask do I understand, is this for me? — that would be great. And 
that for me is a much more interesting challenge for designers”. The panel also 
saw opportunities to nudge children to engagement with information provided 
(for example through gamification or quick quizzes) into designs. And also to 
identify where simpler information may be required if a child doesn’t understand. 


Prominence and engagement 


Reviewers noted that whilst organisations’ designs were excellent, in some cases 
they were difficult to locate in-situ on their services. For example, requiring 
several page click-throughs to find, or placed at the bottom of a lengthy privacy 
policy. 


One reviewer also reflected on opportunities to further increase the impact of 
engaging privacy characters by placing them throughout children’s user journey 
using “just-in-time” notices. They stated “It would be nice if the character could 
explain [data use] in smaller pieces, in different places. Children would then 
start to associate that figure with privacy choices as well”. 


Beyond ensuring prominence of designs, a small number of submissions 
highlighted other approaches for nudging children’s engagements with privacy 
information. The Behavioural Insights Team’s reading time label concept shows 
potential promise. They report that labels estimating how long the average user 
will take to read privacy information boosted click-through rates by 105% - 
although it should be noted that this testing was done with an adult user group 
which may not translate to a children’s audience. The Children’s code team also 
noted that additional metrics are likely needed to develop a holistic picture of the 
effectiveness of privacy information design. For example, exploring reported 
comprehension, variation of reading times between users, and the relationship 
between such metrics and consequent user behaviours. 
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Next steps 


We see the transparency open call as one stage of a wider conversation around 
designing effective privacy information and choices for children. Up to the end of 
the transition period in September 2021, we will be developing design guidance 
and artefacts. These will support designers and engineers to make design 
changes their organisations will need to conform with the code. 


There will be opportunities for designers and engineers to shape and engage 
with this guidance, through a series of ongoing co-design workshops and events. 
Transparency will be a focus area for this work programme. We will consider the 
themes identified as opportunities for progress within this report. If you would 
like to participate in this work, please email childrenscode@ico.org.uk. 


13 


Designing data transparency for children: Annex A 


Annex A: Transparency champions open call text 


The ICO Children’s code team are launching an open call for transparency 
champions. We'd like to hear from online services, children’s rights advocates, 
designers, academics and anyone else working to deliver our vision to place the 
best interests of children at the heart of the online world. 


Why transparency? 


The Children’s code transparency standard sets out a vision for better privacy 
information, where children can easily understand how, when and why services 
use their data free from friction, opacity or confusion. Online services are 
working hard to meet this vision. But we recognise there’s still progress to be 
made. 


A 2018 review of the 1,200 highest ranked apps targeted at children from the 
Google and Apple app-stores found the average reading age for privacy policies 
was 13 years-old - four years above the average reading age for an adult in the 
UK of 9. We’ve heard from stakeholders that privacy information can be hard to 
find and understand, and is too often treated as a tick-box exercise. 


What does the open call involve? 


Participants are invited to submit ideas and examples of privacy information 
designs that meet the vision of the Children’s Code transparency standard. The 
deadline for submissions is 23.00, Friday 30 April 2021. 


Submissions can be speculative designs, early-stage prototypes, or already used 
in the real world. All sectors and services are invited to take part, from 
connected toys to edtech. 


These submissions may be developed by you, or could equally support the good 
work you think others are doing in this space. Concepts could speak to some or 
all of the good practice outlined in the Children’s code, including: 


1. Providing privacy information in a child-friendly way, using wording, 
iconography or other forms of media that are tailored to the age of child 
users 


2. Positioning privacy information within the user experience to ensure it 
responsibly captures children’s attention 


3. Solutions for providing “bite-sized” privacy information at the point that 
its needed by children 


4. Approaches for enabling children (and guardians) to seek more or less 
detail where wanted 
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5. Designing effective incentives and controls that encourage younger 
children to seek the support of an adult where needed 


6. Examples of how organisations are measuring the accessibility and 
usability of privacy information 


7. Anything else that places the best interests of children at the forefront of 
privacy information design! 


Submissions will be reviewed by the ICO’s Children’s Advisory Panel, who will 
choose a selection to publish on the ICO Children’s code Hub as good practice for 
the Children’s code community to learn from. 


We won't crown “winners”, nor use submissions for anything other than 
championing good practice. We recognise organisations’ Children’s code journey 
is not finished, and we do not expect organisations to have produced perfect 
solutions at this stage in the transition period. 


How can I get involved? 


We'd love to hear from anyone with an interest in championing better 
transparency for children online. You can submit a concept developed by 
you/your organisation, or submit the work of another organisation that you 
respect. 


We are happy to receive submissions in forms compatible with email, including 
screenshots, weblinks, documents, videos. Please send submissions 


to childrenscode@ico.org.uk. 


In your submission, please include the following details: 


e Your name and contact details (we will only use this to contact you should 
we wish to discuss and seek consent for using your submission publicly) 


e A link or attachment to the submission concept 


e The name of the organisation or individual who developed/owns the 
concept 
e A brief (>100 words) explanation of how you believe the concept meets 
the vision of the Children’s Code and Transparency standard, supporting 
evidence, and areas for future development 
Submissions will be handled in accordance with our consultation requests privacy 
policy. 


Following the conclusion of the open call, we will be working with a design 
agency to develop further design guidelines and guidance to help online services 
conform with the Children’s Code. For more information on the Children’s Code, 


visit the Children’s Code Hub at https://ico.org.uk/childrenscode. 
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